The User/Permissions GUI presents different result than REST API! Not able to remove permissions

zaphnet_djm7ww

During a scripted user Permissions Audit I discovered that the GUI presents different result than REST API!

Renamed/Deleted users seem to remain in Rest API, but not presented in GUI.

Example:
This role has no members in the GUI:

https://jira.net/rest/api/latest/project/10268/role/10223 

{"self":"https://jira.net/rest/api/latest/project/10268/role/10223","name":"Administrators","id":10423,"description":"This project role was re-created by JIRA Service Desk for managing administrators. Please do not delete this role or edit its name.","actors":[{"id":26793,"displayName":"c-johlan","type":"atlassian-user-role-actor","name":"c-johlan","avatarUrl":"https://jira.net/secure/useravatar?size=xsmall&avatarId=10123"}]}

The user "c-johlan" is not accessible as user active or disabled.

In the GUI I can add and remove other users - but this one not possible to remove!

Reindex does not solve problem, nor upgrade or migration to new server.

Version 8.7.1#807001

Earl McCutcheon

Hello @zaphnet ,

Thanks for reaching out, and this one sounds a bit tricky,  and I need some clarification on the user and what lead to this.

First, and foremost if the user was renamed this sounds a lot like the following BUG, however you noted being on 8.7.1 and this bug should have already been fixed in 8.2.3 and 8.3.0 respectively, but there may be a possible left over connection from the user being renamed in the older version and disconnect being carried over in an upgrade from the previous impacted version:

• https://jira.atlassian.com/browse/JRASERVER-69419

If you see the mismatch mentioned between the app_user and projectroleactor tables described in that BUG there is a API call that can be used to delete the orphaned username from the project role.

But you also noted:

Renamed/Deleted users seem to remain

Was the user c-johlan deleted or was the user renamed?  and if the user was renamed is the current name what the user was renamed to or from?

Generally, its not recommended to delete users in Jira, and its recommended that you just remove them from all groups and roles, as covered in:

• https://confluence.atlassian.com/adminjiraserver087/create-edit-or-remove-a-user-998871734.html

The behavior you are describing sounds like you ran into the scenario where the User was deleted but was directly mapped to a project role, and it got orphaned somewhere on the backend due to the direct user referance in the role not being removed before deleting the user.  Let me know if this is the case.

Next you noted that:

In the GUI I can add and remove other users - but this one not possible to remove

Is the user visible in the front end GUI when viewing the project role page, or is there no indication the orphaned user is set from the front end, and the user is only showing up in the api call?

Another item to check would be if there is a whitespace in the app_user table as described in this KB:

• Unable to remove users from Project role

Regards,
Earl